From 1a3176c4ebeefba98241b84d20009117d4c381be Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Thu, 4 Aug 2005 10:37:51 +0000 Subject: [PATCH] Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP) --- NEWS | 1 + ext/standard/array.c | 4 ++-- ext/standard/tests/array/bug33989.phpt | 10 ++++++++++ 3 files changed, 13 insertions(+), 2 deletions(-) create mode 100755 ext/standard/tests/array/bug33989.phpt diff --git a/NEWS b/NEWS index c568a8d969..1244197137 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,7 @@ PHP 4 NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2005, Version 4.4.1 +- Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry) - Fixed bug #33690 (Crash setting some ini directives in httpd.conf). (Rasmus) - Fixed bug #33673 (Added detection for partially uploaded files). (Ilia) - Fixed bug #33648 (Using --with-regex=system causes compile failure). (Andrei) diff --git a/ext/standard/array.c b/ext/standard/array.c index 2ceef88b7f..7637e24552 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1300,11 +1300,11 @@ PHP_FUNCTION(extract) zval **orig_var; if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) { - zval_ptr_dtor(orig_var); - SEPARATE_ZVAL_TO_MAKE_IS_REF(entry); zval_add_ref(entry); + zval_ptr_dtor(orig_var); + *orig_var = *entry; } else { if ((*var_array)->refcount > 1) { diff --git a/ext/standard/tests/array/bug33989.phpt b/ext/standard/tests/array/bug33989.phpt new file mode 100755 index 0000000000..ccef172d61 --- /dev/null +++ b/ext/standard/tests/array/bug33989.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP) +--FILE-- + +--EXPECT-- +ok -- 2.40.0